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ABSTRACT 



A method and system for providing safe patient monitoring 
in an electronic medical device while serving as a general- 
purpose windowed display is provided. In a preferred 
embodiment, an electronic medical device is capable of 
providing services to executing programs in response to 
requests for services from executing programs. These 
requests for services each specify a service to be provided. 
The electronic medical device ensures the integrity of an 
executing patient monitoring program while simultaneously 
providing services to a non-patient monitoring program that 
is executing. The electronic medical device provides the 
service specified by each request for services from the 
executing patient monitoring program and declines to pro- 
vide services as they are specified by requests for services 
from the executing nonpatent monitoring program if pro- 
vision of the service as specified would interfere with the 
executing patient monitoring program. In one embodiment, 
the electronic medical device omits to provide any service in 
response to a request for services from the executing non- 
patient monitoring program that specifies a service that 
would interfere with the executing patient monitoring pro- 
gram. In one embodiment, the electronic medical device 
provides a service specified by the executing non-patient 
monitoring program in a manner different from that speci- 
fied in the request for services, where the service provided 
in the different manner does not interfere with the executing 
patient monitoring program. 

27 Claims, 5 Drawing Sheets 
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METHOD AND SYSTEM FOR PROVIDING 
SAFE PATIENT MONITORING IN AN 

ELECTRONIC MEDICAL DEVICE WHILE 
SERVING AS A GENERAL-PURPOSE 

WINDOWED DISPLAY 5 

DESCRIPTION 

1. Technical Field 

The invention relates generally to a method and system io 
for presenting visual output in an electronic medical device, 
and more specifically, to a method and system for providing 
safe patient monitoring while serving as a general-purpose 
windowed display. 

2. Background of the Invention 15 
Electronic medical devices such as electrocardiogram 

(E.C.G.) monitors are generally used to monitor a patient's 
condition using medical sensors and/or to deliver medical 
care via automatic medical care delivery systems. These 
devices have long been able to display information directly 20 
relating to patient condition or medical care delivery in both 
graphical and textual forms. For example, an E.C.G. monitor 
might display an electrocardiograph waveform and associ- 
ated text, e.g., pulse rate. This information, displayed 
together, is called a physiological parameter. 23 

These electronic medical devices have customarily 
employed custom hardware and software to achieve their 
results. The advent of general-purpose computing software, 
however, has made it expeditious to implement electronic 
medical devices using some general-purpose software. In 30 
fact, using general-purpose software permits the imple- 
mented electronic medical device to leverage existing oper- 
ating systems, graphical operating environments, and appli- 
cation programs. The use of existing operating systems and 
graphical environments makes the implemented electronic 35 
medical device more flexible by providing a ready-made 
development environment in which third-party vendors may 
develop add-on software products that can execute on the 
electronic medical device. 

40 

In particular, it is desirable to permit third-party applica- 
tions, such as a calculator application, to execute in a 
graphical operating environment, such as the public domain 
X-Window distributed operating environment, along with 
the monitoring programs that perform the primary monitor- 43 
ing function of the electronic medical device. This permits 
the third-party applications to display output in a window on 
the display device and receive input from input devices 
connected to the electronic medical device. 

In many cases, however, third-party applications can 50 
interfere with the primary monitoring function of the elec- 
tronic medical device. Third-party applications can, in many 
cases, capture all user input for extended periods of time, 
lockup the processor when a run-time error occurs, change 
the color of monitoring display, or obscure or generally 55 
disrupt the display organization. Such interference with the 
primary monitoring function of the electronic medical 
device is a matter of great concern, as it could cause 
important information from the electronic medical device to 
go unobserved by personnel monitoring the electronic medi- ^o 
cal device, adversely impacting patient care. 

First, in most windowed operating environments, all the 
active applications are eligible to receive user input User 
input in most windowed operating environments is directed 
to the application which has the input focus. Typically, the 65 
cursor is used to select the application window which is to 
have the input focus. In many window operating environ- 



ments, however, a single application can "capture" the 
cursor and prevent the system and operator from changing 
the input focus. This permits third-party applications to 
deprive patient monitoring applications of user input for 
extended periods of time. This deprivation can significantly 
interfere with the primary monitoring functions of the elec- 
tronic medical device such as acknowledging alarm events, 
turning alarms off, or just generally interacting with the 
electronic medical device. 

In many windowing systems, capturing the cursor also 
causes the display contents to "freeze" until the cursor is 
"released." A typical example is scroll bars that update the 
display only after a user has positioned the scroll bar and 
released the cursor. Under this circumstance, however, stale 
or incorrect patient information will be displayed while the 
electronic medical device's display is frozen. 

Second, in many windowed operating environments, 
when a runtime error occurs during the execution of a 
request from a third-party application, "processor lockup" 
occurs. This is a condition of a processor which prevents it 
from completing the execution of the current request and 
proceeding to execute further requests. If a third-party 
application causes processor lockup to occur, requests from 
patient monitoring applications waiting for execution cannot 
be executed. This interferes with the primary monitoring 
function of the electronic medical device by preventing the 
display of important patient monitoring information. 

Third, most windowed operating environments permit 
third-party applications to modify the colors used to display 
information. Most graphical operating environments main- 
tain a single color table to map virtual colors, understood by 
applications, to actual color values that may be displayed on 
a display device. In order to be able to select the actual 
colors displayed, each application is permitted to change the 
contents of the color table. The number of colors required by 
all the applications often exceeds the capacity of the color 
table. When this occurs, most windowed operating environ- 
ments permit applications to maintain their own virtual color 
map, which is loaded into the physical color map whenever 
that particular application has the input focus. This has the 
side effect of changing the display colors for the entire 
display adversely affecting the rest of the applications. For 
instance, a third-party application could change the actual 
color of the monitoring applications information to the 
actual color of the background making the patient informa- 
tion invisible. This would also allow third party applications 
to change monitoring applications colors which have special 
significance, e.g., red for an alarm condition, to another 
color having a different significance, e.g., blue for a non- 
alarm condition. In this example, an alarm condition could 
be displayed in blue instead of red, giving those monitoring 
the electronic medical device the false impression that no 
alarm condition is active. 

Fourth, most modem windowing environments support 
overlapping windows in which windows are permitted to 
overlay some or all of the area of other windows. This 
permits a third-party application's window to overlay impor- 
tant information displayed by the monitoring applications. 
For example, a user of a third-party application may drag the 
window containing output from the third-party application 
to a portion of the display occupied by important informa- 
tion such as alarm notification messages. At this point, the 
important information "displayed" by the monitoring pro- 
grams is actually obscured by the applications window, and 
cannot be seen by those monitoring the electronic medical 
device. Important command windows or notifications of 
alarm events needed by the user to begin monitoring new 
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conditions or otherwise control the state of the electronic 
medical device can likewise be overlaid. 

Fifth, because users can rearrange the contents of the 
display as described above, the display may be left in 
completely different states. For example, windows for vari- 5 
ous third-party applications may be scattered about the 
display area. Portions of the information displayed by the 
monitoring programs may be relocated and obscured, as 
may be command windows. This makes it confusing for a 
different user, or even the same user returning later, to locate 10 
important intbrmation or command windows. 

Because user interface reliability problems in electronic 
medical devices could compromise the health, or even life of 
the patients on which they are used, it is especially important 
that they be addressed in any system that supports the use of 15 
third-party applications in a windowed operating environ- 
ment. 



SUMMARY OF THE INVENTION 



20 



It is an object of the invention to provide, in an electronic 
medical device capable of providing services to executing 
programs In response to requests for services from executing 
programs, the requests for services specifying a service to be 
provided, a method and system for ensuring the integrity of 25 
an executing patient monitoring program. 

It is another object of the invention to provide, in an 
electronic medical device having both a microprocessor and 
a display device, the display device having a display area, a 
method and system for ensuring the integrity of the display 30 
of the output of patient monitoring programs while simul- 
taneously displaying the output of additional executing 
programs. 

These and other objects, which will become apparent as 
the invention is more fully described below, are provided by 35 
a method and system for providing safe patient monitoring 
in an electronic medical device while serving as a general- 
purpose windowed display. In a preferred embodiment, an 
electronic medical device is capable of providing services to 
executing programs in response to requests for services from 40 
executing programs. These requests for services each 
specify a service to be provided. The electronic medical 
device ensures the integrity of an executing patient moni- 
toring program while simultaneously providing services to 
an executing non-patient monitoring program. The elec- 43 
tronic medical device provides the service specified by each 
request for services from the executing patient monitoring 
program and declines to provide services as they are speci- 
fied by requests for services from the executing non-patient 
monitoring program if provision of the service as specified 50 
would interfere with the executing patient monitoring pro- 
gram. In one embodiment, the electronic medical device 
refuses to provide any service in response to a request for 
services from the executing non-patient monitoring program 
that specifies a service that would interfere with the execut- 
ing patient monitoring program. In one embodiment, the 
electronic medical device provides a service specified by the 
executing non-patient monitoring program in a manner 
different from that specified in the request for services, 
where the service provided in the different manner does not 60 
interfere with the executing patient monitoring program. 

BRIEF DESCRIPTION OF THE DRAWINGS 

FIG. 1 is a high-level block diagram of the electronic 65 
medical device in which a preferred embodiment of the 
invention operates. 



55 



FIGS. 2A-2B are display images showing an example of 
protected regions enforcement. 

FIGS. 3A-3B are screen images showing the operation of 
the normal screen command window, 



DETAILED DESCRIPTION OF THE 
INVENTION 

I. Overview 

The inventive method and system provides safe patient, 
monitoring in an electronic medical device while serving as 
a general-purpose windowed display. In a preferred embodi- 
ment, system services are provided in the electronic medical 
device that protect the integrity of the primary monitoring 
function of the electronic medical device from interference 
caused by third-party application programs (third-party 
applications). These system services, along with specialized 
hardware, intervene to prevent extended user input capture, 
detect and correct run-time processor lockup, provide sepa- 
rate color tables for monitoring programs and third-party 
applications, enforce protected regions within the display 
area into which output from the third-party applications 
cannot be moved, provide a command that is always avail- 
able to users for returning the display area to a standard 
organization, optionally restrict the number of visible third- 
party applications, and iconify large third-party application 
windows when a monitoring alarm condition occurs. In a 
preferred embodiment, the system services described are 
provided by modifying aspects of the standard version of 
X-Windows, a public domain distributed operating environ- 
ment and by fabricating specialized hardware for executing 
the operating environment and other programs. 

FIG. 1 is a high-level block diagram of the electronic 
medical device in which a preferred embodiment of the 
invention operates. The electronic medical device 100 con- 
tains a patient monitoring subsystem (monitoring sub- 
system) 110 for collecting and analyzing patient data and a 
graphics subsystem 120. for displaying output and receiving 
user input for both patient monitoring applications and 
non-patient monitoring applications. The electronic medical 
device also includes shared memory 130 that may be 
accessed by both the monitoring subsystem and the graphics 
subsystem. The electronic medical device further includes a 
network connection 140 that may be used by both the 
monitoring subsystem and the graphics subsystem to com- 
municate with other computer systems connected to the 
electronic medical device by a network. The monitoring 
subsystem contains dedicated monitoring memory (moni- 
toring memory) 111, a monitoring central processing unit 
(monitoring CPU) 112 and medical sensors 113-115, such as 
E.C.G. electrodes or pulse oximetry sensors, to monitor 
patients. Patient data from the medical sensors is stored in 
the monitoring memory and analyzed by the monitoring 
CPU, The monitoring CPU requests display services from 
the graphics subsystem in order to display the results of 
patient data analysis. The graphics subsystem supports user 
input/output devices 123 with which to display information, 
including messages, to users and accept input from them. 
Among the user input/output devices is a display device 124 
comprising a video monitor 125, fox displaying information, 
and a display interface 126 for controlling and transmitting 
information to the video monitor. The user input/output 
devices further include a keyboard 127 and a pointing device 
128, such as a mouse. The programs required to provide the 
system services of the preferred embodiment, as well as 
monitoring programs and third-party applications, reside in 
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the graphics memory. The graphics memory is preferably a 
solid-state memory device whose contents may be perma- 
nent or may be loaded from, a local disk drive or a remote 
disk drive controlled by a separate computer system to 
which the electronic medical device 100 is connected via the 5 
network connection. The above programs execute on a 
graphics CPU 122, or on the CPU of a separate computer 
system to which the electronic medical device 100 is con- 
nected via the network connection. 

U. Prevent Extended User Input Capture 

When a third-party application captures the cursor, all 
subsequent user input is directed to the capturing third-party 
application. While this is necessary in some situations, e.g., 
to cause a scroll bar in the third-party application's window 15 
to function properly, the longer the capture continues, the 
longer the patient monitoring programs are deprived of any 
user input and the display contents are frozea Since this can 
prevent users from perforrning necessary interaction with 
patient monitoring programs and cause stale or incorrect 20 
information to be displayed, the electronic medical device 
limits the amount of time for which any third-party appli- 
cation can capture the focus. The electronic medical device 
preferably starts a countdown each time a third-party appli- ^ 
cation captures the cursor. If a preselected period of time 
elapses before the capturing third-party application releases 
the cursor, the electronic medical device forces the capturing 
third-party application to release the cursor allowing the 
display to be refreshed and the input focus changed. 30 

in. Detect and Correct Run-Time Processor Lockup 

Run-time errors encountered by the electronic medical 
device's graphics processor while executing a request for a 
third-party application can cause the lockup of the graphics 
processor. This is a condition of a processor that prevents it 35 
from completing the execution of the current request and 
proceeding to execute further requests. To detect and correct 
run-time processor lockup, a graphics, processor lockup 
watchdog is preferably included in the electronic medical ^ 
device. The graphics processor lockup watchdog (watchdog) 
is a hardware-implemented countdown timer that counts 
down from a preselected interval and, when the interval 
expires, concludes that graphics processor lockup has 
occurred and attempts to correct it. The graphics processor, 45 
when it is operating normally, repeatedly refreshes the 
watchdog before enough time elapses for the interval to 
expire, restarting the interval. When the graphics processor 
encounters a run-time error causing a loadup, the graphics 
processor is unable to refresh the watchdog. The interval 50 
then expires, and the watchdog blanks the display area to 
prevent the display of old or incorrect irtformation stored in 
display memory. The watchdog then signals the monitoring 
processor to attempt to correct the graphics processor lockup 
by raising a monitoring processor interrupt. The monitoring 55 
processor, in response to the interrupt, attempts to correct the 
graphics processor lockup by first canceling the request that 
the graphics processor is currently executing. If this fails, the 
monitoring processor attempts to correct the graphics pro- 
cessor lockup by resetting the graphics processor. If this 50 
fails, the monitoring processor attempts to correct the graph- 
ics processor lockup by warmstarting the electronic medical 
device, clearing the contents of graphics subsystem memory 
and shared memory, but maintaining the contents of moni- 
toring subsystem memory which contains patient informa- 55 
tion. 

IV. Provide Separate Color Tables 



Generally, all applications display information on the 
display device by selecting a real color value (typically 24 
bits) in which the information should be displayed, storing 
a mapping in a central color mapping table that maps to the 
selected real color value from some virtual color value small 
enough to fit in the storage allocated for each pixel in display 
memory (typically 8 bits), and using drawing routines to 
change the value of the display memory locations corre- 
sponding to the desired pixels to the virtual color value used 
in the mapping. When the display interface periodically 
refreshes the displayed contents of the video monitor, it 
reads the virtual colors from display memory, maps them to 
real color values using the mapping table, transforms the 
digital real color value into an analog real color signal using 
one or more digital-to-analog converters, and refreshes the 
video monitor with the analog signal. 

When a third-party application has the focus, it can 
change mappings stored in the color mapping table. Any 
mappings stored earlier by the monitoring programs in the 
color mapping table would therefore usually be subject to 
undesirable modification by third-party applications. In 
order to prevent this, one or more additional color mapping 
tables are allocated within the display interface and an 
attribute portion containing one or more mapping table 
selection bits is preferably added to the data portion of each 
pixel in display memory. The mapping table selection bits 
are used by the display interface to determine which color 
table to use to display a given pixel. The Window Manager, 
which is responsible for initializing pixels to display newly 
opened windows, is preferably modified to also initiahze the 
color table mapping bits. When a third-party application 
opens a window, the Window Manager sets the color table 
mapping bits for each pixel in the window to designate a 
default color mapping table. This is the color mapping table 
that is modified when the standard X- Windows service for 
modifying the color mapping table is invoked. The other 
color mapping tables are reserved for use by the monitoring 
applications. When a monitoring program opens a window, 
the Window Manager sets the color table mapping bits for 
each pixel in the window to designate one of the additional 
color mapping tables. Because the monitoring programs are 
aware of the additional color mapping tables, they are able 
to invoke a special service, unknown to third-party appli- 
cations, to modify the additional color mapping tables. 
When the display interface sees the color table selection bits 
that designate one of the additional color mapping tables 
when displaying pixels displayed by a monitoring program, 
it uses the appropriate color mapping table to map the virtual 
color value to an actual color value. Because the monitoring 
programs are unaware of the additional color mapping 
tables, they cannot modify the mappings stored therein by 
monitoring programs, and may therefore not alter the actual 
colors in which the monitoring programs display informa- 
tion. 

In a preferred embodiment, two phantom memory regions 
are created in memory that both resolve to the actual display 
memory. The first of these phantom memory ranges is 
supplied to programs for passing to drawing routines called 
to display information. This range maps to the data portion 
of each pixel in display memory, where the virtual color 
value is stored. When programs use drawing routines to 
modify the first phantom memory region, they modify only 
the data portions of display memory containing only virtual 
color values, and do not affect the attribute portions of 
display memory containing color map selection bits. The 
second of these phantom memory ranges is used to set 
attributes for each pixel stored in the attribute portions of the 
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representation of each pixel in display memory. Attributes 
include color mapping table selection bits, as well as other 
data required to administer the display for monitoring pro- 
grams. This other data includes indications of whether the. 
pixel will be used to display patient physiological param- 5 
eters or real-time video, each using custom drawing facilities 
instead of the standard X-Windows drawing routines. The 
other data also includes indications of whether the other bits 
of the attribute portion and all of the bits of the data portion 
together contain a truncated real color value, called a true 1Q 
color value, to be displayed by the display interface without 
color mapping. The second phantom range is used by the 
modified window manager to quickly initialize or change the 
attributes for a group of pixels without changing the virtual . 
color value of any of pixels in the group. 
V. Enforce Protected Regions 13 
In the preferred embodiment, protected regions include 
critical patient information such as high priority physiologi- 
cal parameters and a patient status area used to notify the 
operator of local alarm events. Command windows are also ^ 
protected. The command windows are made up of menu 
keys that are used by the operator to invoke commands that 
modify the state of the electronic medical device such as 
acknowledging alarm events. The window manager moni- 
tors window open and movement requests made by the ^ 
applications to the X- Window X-Server. When the Window . 
Manager observes a request from an application window to 
overlap a protected region, the Window Manager submits a 
request to the X-Server to move the window to a new, nearby 
location outside of all the protected zones. This prevents any 3Q 
application from overlapping the contents of a protected 
region. 

FIGS. 2A-2B are display images showing an example of 
protected regions enforcement. The display area 200 con- 
tains protected regions 201, containing important patient 35 
parameters 202 and 203; 204, containing hard keys 
205-209; and 210, containing soft keys 211-215 and patient 
status area 216. A user uses a pointing device to move the 
window for a third-party calculator program 22 1 in its 
present location to a target location shown in FIG. 2A by a 40 
broken-line box 222. The target location overlays a pro- 
tected region 201 encompassing important patient param- 
eters 202 and 203. The third-party application program 
submits a request to the X-Server to move the window to the 
new location. The Window Manager observes the request, 45 
determines that the target location is within a protected 
region, and submits an instruction to the X-Server to move 
the window to location 221, outside of all of the protected 
regions as shown in FIG. 2B. 

An application may request that the Window Manager 50 
display its output window in a full-screen mode. In this 
mode, the entire display is used to display the requesting 
application's window. In a preferred embodiment, the elec- 
tronic medical device relaxes protected region enforcement 
when an application requests the full-screen display of its 55 
window to permit the satisfaction of the request. That is, the 
electronic medical device satisfies full-screen requests, even 
though they encroach on all of the protected regions. In 
order to ensure that the satisfaction of a request for full- 
screen mode does not obscure alarm condition messages, the so 
Window Manager is preferably modified to iconify any 
full- screen window as soon as the electronic medical device 
encounters an alarm condition. This permits the electronic 
medical device to display the alarm condition message 
without it being obscured by the full-screen window. The 65 
Window Manager is further preferably able to iconify any 
window larger than a configurable threshold area when the 



electronic medical device encounters an alarm condition, 
making it less likely that alarm condition messages will be 
obscured by any display window. 

VI. Provide Command For Returning The Display Area 
To A Standard Organization 

A "normal screen" command for returning the display 
area to a standard organization is preferably always avail- 
able to the user. A command window, preferably a hard key 
as described above, is displayed in a protected region, 
permitting the user to invoke the normal screen command at 
any time. The command window may be invoked by a user 
when the contents of the display area have become rear- 
ranged and confusing to return the display area to a familiar 
organization in which important information can be readily 
located. 

FIGS. 3A-3B are screen images showing the operation of 
the normal screen command window. FIG. 3 A shows the 
contents of the display area 300 in a relatively confusing 
state. The display area contains hard keys 301-306, includ- 
ing "normal screen" hard key 306, soft keys 311-315. High 
priority patient parameters 321 and 322 are completely 
visible, but other patient parameters are not: patient param- 
eters 323 is partially obscured by a calendar application 
window 341, and patient parameter 324 is completely, 
obscured by a calculator application window 342. An alarm 
watch window 331 is also partially obscured by a calendar 
application window 341. In order to return the display area 
to a familiar organization in which important information 
can be readily located, the user uses the pointing device to 
activate the normal screen hard key. 

In response to the activation of the normal screen hard 
key, the electronic medical device returns the display to a 
standard organization. The electronic medical device "ico- 
nifies" any application programs, or closes their windows 
and displays small icons in their place. This leaves only 
patient and alarm watch windows visible. The user may 
restore the window for any iconified application in its 
original location by using the pointing device to select its 
icon. This is shown in FIG. 3B. The calendar application 
window 341 and calculator application window 342 have 
been iconified, replaced with calendar icon 347 and calcu- 
lator icon 346, respectively. This has the effect of making 
patient parameters 323 and 324 as well as alarm watch 
window 33 1, completely visible. 

VII. Optionally Restrict The Number Of Visible Third- 
Party Applications 

The user is permitted to specify a special display mode in 
which only a predetermined maximum number of third- 
party application are visible at a given time. In view of the 
low tolerance of beginner users for display complexity, the 
maximum number is preferably one. This restriction is 
implemented by modifying the Window Manager to keep 
track of the number of third-party applications that have 
open windows. If the Window Manager receives a request 
from a third-party application to open a new window, and if 
the user has specified the special display mode, and if the 
number of third-party applications that have open windows 
is equal to the maximum number of third-party applications, 
then the Window Manager selects a third-party application 
having an open window to iconify. The Window Manager 
preferably selects the third-party application with an open 
window that has the lowest priority. The Window Manager 
then iconifies the selected third-party application so that its 
window is no longer displayed and continues to open a new 
window in response to the request. This limits the extent to 
which important monitoring information can be obscured 
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from the user. 
Vin. Conclusion 

While this invention has been shown and described with 
reference to preferred embodiments, it will be understood by 
those skilled in the art that various changes or modifications 5 
in form and detail may be made without departing from the 
scope of the invention. For example, virtually each aspect of 
the invention could be implemented either in software or 
hardware design. 

We claim: 10 

1. In an electronic medical device capable of providing 
services to executing programs in response to requests for 
services from executing programs, the requests for services 
specifying a service to be provided, a method for ensuring 
the integrity of an executing patient monitoring program 13 
while simultaneously providing services to an executing 
non-patient monitoring program, the method comprising the 
steps of: 

executing the patient monitoring program; 2Q 
providing the service specified by each request for ser- 
vices from the executing patient monitoring program; 
executing the non-patient monitoring program; and 
declining to provide services as specified by requests for 
services from the executing non-patient monitoring 25 
program if provision of the service as specified would 
interfere with the executing patient monitoring pro- 
gram, 

wherein at least a portion of the requests for services from 
executing programs specify a window display service 30 
for displaying a window containing output from the 
requesting application, the displayed window having an 
area, and wherein, for these requests, the declining step 
is accomplished by the steps of: 

providing the window display service specified by the 
executing non-palient monitoring program; 

detecting an alarm condition; and 

upon detecting the alarm condition, if the displayed 
window has an area greater than a threshold area, 40 
reducing the area of the displayed window. 

2. The method of claim 1 wherein the step of declining to 
provide services is accomplished by omitting to provide any 
service in response to a request for services from the 
executing non-patient monitoring program that specifies a 45 
service that would interfere with the executing patient 
monitoring program. 

3. The method of claim 2 wherein the electronic medical 
device has a display device having a display area, and 
wherein at least a portion of the requests for services from 50 
executing programs specify a display service for displaying 
specified output within the display area, and wherein the 
providing step is accomplished by displaying the output 
specified by the request in a location within the display area 
that is substantially the same as the location specified by the 55 
request, and wherein the step of omitting to provide any 
service that would interfere with the executing patient 
monitoring program by omitting to display the output speci- 
fied by the request if the display of the output specified by 
the request would interfere with the display of output by the 60 
executing patient monitoring program. 

4. The method of claim 2 wherein the electronic medical 
device maintains a patient monitoring program color map- 
ping table for mapping virtual color values used by the 
executing patient monitoring program to real color values, 65 
and wherein at least a portion of the requests for services 
from executing programs specify a patient monitoring pro- 
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gram color mapping table alteration service for altering the 
real color value to which a specified virtual color value used 
by the executing patient monitoring program maps in the 
patient monitoring program color mapping table, and 
wherein the providing step responds to requests specifying 
the patient monitoring program color mapping table alter- 
ation service from the executing patient monitoring program 
by altering the real color value to which a specified virtual 
color value used by the executing patient monitoring pro- 
gram maps in the patient monitoring program color mapping 
table, and wherein the step of omitting to provide any 
service that would interfere with the executing patient 
monitoring program is accomplished by responding to 
requests specifying the patient monitoring program color 
mapping table alteration service from the executing non- 
patient monitoring program by omitting to alter the real 
color value to which the specified virtual color value used by 
the executing patient monitoring program maps in the 
patient monitoring program color mapping table. 

5. The method of claim 1 wherein requests for services 
from executing programs further specify, a manner in which 
the services to be provided, and wherein the step of declin- 
ing to provide services is accomplished by adaptively pro- 
viding a service specified by the executing non-patient 
monitoring program in a manner different from that speci- 
fied in the request for services that does not interfere with the 
executing patient monitoring program. 

6. The method of claim 5 wherein the electronic medical 
device has a display device having a display area, and 
wherein at least a portion of the requests for services from 
executing programs specify a display service for displaying 
specified output at a specified location within the display 
area, and wherein the providing step is accomplished by 
displaying the output specified by the request in a location 
within the display area that is substantially the same as the 
location specified by the request, and wherein the adaptively 
providing step is accomplished by displaying the output 
specified by the request in a location within the display area 
that is as close to the location specified by the request as is 
possible without interfering with the display of output by the 
executing patient monitoring program. 

7. The method of claim 5 wherein the electronic medical 
device maintains a patient monitoring program color map- 
ping table for mapping virtual color values used by the 
executing patient monitoring program to real color values, 
and wherein at least a portion of the requests for services 
from executing programs specify a patient monitoring pro- 
gram color mapping table alteration service for altering the 
real color value to which a specified virtual color value used 
by the executing patient monitoring program maps in the 
patient monitoring program color mapping table, and 
wherein the electronic medical device also maintains a 
non-patient monitoring program color table for mapping 
virtual color values used by the executing non-patient moni- 
toring program to real color values, and wherein the pro- 
viding step responds to requests specifying the patient 
monitoring program color mapping table alteration service 
from the executing patient monitoring program by altering 
the real color value to which a specified virtual color value 
used by the executing patient monitoring program maps in 
the patient monitoring program color mapping table, and 
wherein the adaptively providing step is accomplished by 
responding to requests specifying the patient monitoring 
program color mapping table alteration service from the 
executing non-patient monitoring program by altering the 
real color value to which a specified virtual color value used 
by the executing non-patient monitoring program maps in 
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the non-patient monitoring program color mapping table. 

8. The method of claim 5 wherein at least a portion of the 
requests for services from executing programs specify a user 
input capture service for capturing substantially all of the 
input provided by a user, and wherein requests for services $ 
that specify the user input capture service also specify a user 
input capture duration, and wherein the providing step is 
accomplished by providing the user input capture service for 
the specified user input capture duration, and wherein the 
adaptively providing step is accomplished by providing the 1Q 
user input capture service for a duration not exceeding a 
predetermined maximum duration. 

9. The method of claim 5 wherein the adaptively provid- 
ing step is accomplished by the steps of: 

providing the service specified by the executing non- ^ 

patient monitoring program; 
detecting a run-time error during the provision of the 

service; and 

upon detecting the run-time error, ceasing to provide the 
service specified by the executing non-patient monitor- 20 
ing program. 

10. The method of claim 9 wherein the ceasing to provide 
step is accomplished by resetting the electronic medical 
device. 

11. The method of claim 1 wherein the step of reducing 25 
the area of the displayed window includes the step of 
iconifying the displayed window. 

12. In an electronic medical device having a micropro- 
cessor, a display device, and an input device, the display 
device having a display area, a method for ensuring the 30 
integrity of the display of the output of patient monitoring 
programs while simultaneously displaying the output of 
additional executing programs, the additional programs 
being capable of capturing input from the input device, the 
method comprising the steps of: 35 

limiting the duration of input capture by any of the 
additional programs; 

using an additional program display color mapping table 
that is modifiable by the additional programs to display ^ 
the output of the additional programs and a separate 
patient monitoring program display color mapping 
table that is modifiable by the patient monitoring pro- 
grams and unmodifiable by the additional programs to 
display the output of the patient monitoring programs; 45 

preventing the display of the output of the additional 
programs in predefined protected regions within the 
display area; 

in response to receiving a normal screen command, redis- 
playing the contents of the display area in a preselected 50 
standard organization; 

in response to a request from the executing additional 
program, displaying a window for containing output or 
the executing additional program; 

detecting an alarm condition; and 53 

upon deleting the alarm condition, if the displayed win- 
dow has an area greater than a threshold area reducing 
the area of the displayed window. 

13. The method of claim 12, further including the steps of: ^ 
detecting a run-time error while displaying the output of 

an executing program; and 
clearing the detected run-time error. 

14. The method of claim 12, further including the step of 
limiting the number of additional programs that may display 65 
information in the display area to a predetermined maximum 
number of additional programs. 



15. The method of claim 14 wherein the limiting step 
includes the steps of: 

in response to a request to display the output of one of the 
additional programs, comparing the number of the 
additional programs presently executing to the prede- 
termined maximum number of the additional programs; 

approving the request to display the output of one of the 
additional programs; and 

if the number of the additional programs presently execut- 
ing is not less than the predetermined maximum num- 
ber of additional programs, iconifying the output dis- 
played in accordance with an earlier-approved request 
to display the output of one of the additional programs. 

16. The method of claim 12 wherein the display area is 
comprised of pixels, each of the pixels being periodically 
refreshed with a real color value, and wherein the step of 
using separate display color mapping tables to display the 
output of the patient monitoring programs and the output of 
the additional programs includes steps of: 

when a pixel in the display area to be refreshed, reading 
an attribute portion of the pixel representation corre- 
sponding to the pixel that is to be refreshed; 

selecting one of a plurality of available color mapping 
tables based upon the read attribute portion of a virtual 
color value, each of the available color mapping tables 
mapping a virtual color value to a real color value; 

reading a virtual color value portion of the pixel repre- 
sentation containing a virtual color value; 

using the selected color mapping table to map the virtual 
color value of the read virtual color value portion of the 
pixel representation to a real color value; and 

refreshing the pixel using the real color value. 

17. The method of claim 12 wherein the step of preventing 
the display of the output of the additional programs in 
predefined protected regions within the display area includes 
the steps of: 

receiving a display request to display specified output of 
one of the additional programs in a specified target 
region within the display; 

determining whether the specified target region of the 
received request intersects a protected region; 

if the specified target region of the received request 
intersects a protected region: 

identifying an alternate target region within the display 
that is near the specified target region and that does not 
intersect any protected region, and 

causing the specified output to be displayed in the alter- 
nate target region; and 

if the specified target region of the received request 
intersects no protected regions, causing the specified 
output to be displayed in the specified target region. 

18. In an electronic medical device having both a micro- 
processor and a display device, the display device having a 
display area, a method for ensuring the integrity of the 
display of the output of patient monitoring programs while 
simultaneously displaying the output of additional executing 
programs by limiting the number of the additional programs 
that may display information in the display area to a pre- 
determined maximum number of additional programs, the 
method comprising the steps of: 

in response to a request to display the output of one of the 
additional programs, comparing the number of the 
additional programs presently executing to the prede- 
termined maximum number of additional programs; 
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approving the request to display the output of one of the 
additional programs; 

if the number of the additional programs presently execut- 
ing is not less than the predetermined maximum num- 
ber of additional programs, iconifying the output dis- 5 
played in accordance with an earlier-approved request 
to display the output of one of the additional programs; 

in response to the approving step, displaying the addi- 
tional program output in a section of the display area: 

detecting an alarm condition; and M 

upon detecting the alarm condition reducing the area of 
the section of the display area in which the additional 
program output is displayed. 

19. In on electronic medical device upon which programs 
may execute, the display device having a display area, a 15 
method for ensuring the integrity of the display of the output 
of patient monitoring programs while simultaneously dis- 
playing the output of additional executing programs by 
preventing the display of the output of the additional pro- 
grams in predefined protected regions within the display 20 
area, the method comprising the steps of: 

receiving a display request to display specified output of 
one of the additional programs in a specified target 
region within the display; ^ 

determining whether the specified target region of the 
received request intersects a protected region; 

if the specified target region of the received request 
intersects a protected region: 

identifying an alternate target region within the display 30 
that is near the specified target region and that does not 
intersect any protected region, and 

causing the specified output to be displayed in the alter- 
nate target region; 

if the specified target region of the received request 
intersects no protected regions, causing the specified 
output to be displayed in the specified target region; 

detecting an alarm condition; and 

upon detecting the alarm condition, if the displayed 40 
specified output has an area greater than a threshold 
area, reducing the area of the displayed specified out- 
put. 

20. An electronic medical device capable of executing and 
displaying output for both patient monitoring programs and 45 
additional programs, the electronic medical device compris- 
ing: 

a display device having a display area in which output for 
both patient monitoring programs and additional pro- 
grams is displayed; 50 

a memory for storing the patient monitoring programs and 
the additional programs; 

a processor for executing the patient monitoring programs 
arid the additional programs; j3 

a display interface for displaying visual output in the 
display area of the display device that uses an addi- 
tional program display color mapping table that is 
modifiable by the additional programs to display the 
output of the additional programs and a separate moni- ^ 
toring program display color mapping table thai is 
modifiable by the patient monitoring programs and 
unmodi liable by the additional programs to display the 
output of the patient monitoring programs; 

a display regulator for preventing the display of the output 65 
of the additional programs in predefined protected 
regions within the display area; 
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a screen reorganizer for redisplaying the contents of the 
display area in a preselected standard organization in 
response to receiving a normal screen command; and 

an alarm condition message protector for reducing the 
size of windows displayed on the display device in 
response to the display of an alarm condition message 
on the display device in order to ensure the visibility of 
the alarm condition message. 

21. The electronic medical device of claim 20, further 
including: 

an input device from which input is received; and 

an input capture limiter for limiting the duration of any 

capture of input from the input device by an additional 

program. 

22. The electronic medical device of claim 20, further 
including a processor watchdog for detecting and correcting 
the lockup of the processor. 

23. The electronic medical device of claim 20 wherein the 
display regulator includes an additional program display 
limiter for limiting the number of additional programs that 
may simultaneously display output within the display area. 

24. An electronic medical device capable of displaying 
output for both patient monitoring programs and additional 
programs, the electronic medical device comprising: 

a display device having a display area in which output for ' 
both patient monitoring programs and additional pro- 
grams is displayed; 

a network connection for connecting via a network to a 
remote computer system for storing and executing the 
patient monitoring programs and the additional pro- 
grams; 

a display interface for displaying visual output in the 
display area of the display device that uses an addi- 
tional program display color mapping table that is 
modifiable by the additional programs to display the 
output of the additional programs and a separate patient 
monitoring program display color mapping table that is 
modifiable by the patient monitoring programs and 
unmodifiable by the additional programs to display the 
output of the patient monitoring programs; 

a processor regulator for inhibiting the monopolization of 
program execution resources of the remote computer 
system by any of the additional programs; 

a display regulator for preventing the display of the output 
of the additional programs in predefined protected 
regions within the display area; 

a screen reorganizer for redisplaying the contents of the 
display area in a preselected standard organization in 
response to receiving a normal screen command; and 

an alarm condition message protector for reducing the 
size of windows displayed on the display device in 
response to the display of an alarm condition message 
on the play device in order to ensure the visibility of the 
alarm condition message. 

25. In an electronic medical device, a method for ensuring 
the integrity of an executing patient monitoring program 
while simultaneously providing services to an executing 
non-patient monitoring program, the method comprising the 
steps of: 

in response to a request from the executing non-patient 
monitoring program, displaying a window for contain- 
ing output of the executing non-patient monitoring 
program; 

detecting an alarm condition; and 

upon detecting the alarm condition, if the displayed 
window has an area greater than a threshold area, 
reducing the area of the displayed window. 
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26. The method of claim 25 wherein the step of reducing 
the area of the displayed window includes the step of 
iconifying the displayed window. 

27. An electronic medical device capable of executing and 
displaying output for both patient monitoring programs and 
additional programs, the electronic medical device compris- 
ing: 

a display device having a display area in which output for 
both patient monitoring programs and additional pro- 
grams is displayed; 

a memory for storing the patient monitoring programs and 
the additional programs; 
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a processor for executing the patient monitoring programs 
and the additional programs; and 

an alarm condition message protector for reducing the 
size of windows displayed on the display device in 
response to the display of an alarm condition message 
on the display device in order to ensure the visibility of 
the alarm condition message. 
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